DDoS (distributed denial of service) attacks are a major threat and risk exposure facing any business with an internet-facing server. They can be especially devastating to companies that primarily conduct sales through the internet, resulting in a network crash that can disrupt business and diminish profits and cause irreparable damage to a brand. Research firm the Yankee Group estimates that an average size company ($10 million in annual revenue) can lose $150,000 in a successful DDoS attack. I spoke with Jag Bains, CTO of DOSarrest in Vancouver, Canada, about the very real threat of DDoS and how organizations can mitigate their exposure to these attacks.

A Q&A with Christopher Watson
The IRS Safeguards Program was designed to ensure that federal, state and local agencies properly protect federal tax information, and the requirements cover computer security, among other things. I spoke with Christopher Watson, senior manager of internal audit and risk advisory services at Schneider Downs & Co. in Columbus, OH, to find out more about the Program and what it entails.

A Q&A with Grayson Lenik
The retail industry is now the top target for cybercriminals, according to the 2013 Trustwave Global Security Report, and payment card data (PCI) is a critical area of concern. Yet many businesses, especially smaller retailers, are still unaware of basic PCI requirements. I asked Grayson Lenik, senior security consultant at Trustwave, for an overview of what small merchants need to know.

A Q&A with Nathan Steuer and Peter Coddington
Mobile devices are essentially computers that can go anywhere the employee goes. While these devices enable powerful computing capabilities, they are also easily lost and left unprotected, creating additional data security risks for organizations that use them. I asked Nathan Steuer, business development director, and Peter Coddington, CEO of PaRaBal, Inc., in Catonsville, MD, about limiting the vulnerabilities of mobile devices.

A Q&A with Ryan Kriger
Among state Attorneys General, Vermont has gained a reputation for being particularly aggressive about data breach and privacy regulation. To better understand the state’s Consumer Protection Act requirements and processes for data breach investigation, I talked to Ryan Kriger, Assistant Attorney General.

A Q&A with Kenneth Levine
Subrogation is an emerging topic in cyber liability insurance, as insurance companies are starting to pursue compensation from any third parties that can be held responsible for a data breach. To get a better handle on the current reality of subrogation in this area, I spoke to Kenneth Levine, partner at Nelson, Levine, de Luca & Hamilton, LLC.

A Q&A with Dominique Shelton
The area of mobile app customer data collection is fraught with heightened regulatory interest. In the past 18 months, industry leaders have come together to create the Best Practices in Mobile Data Collection guidance while the California Attorney General released “Privacy on the Go.” To get a better handle on the issue of mobile app data collection, I spoke with Dominique Shelton of Edwards Wildman Palmer, LLP in Los Angeles, CA.

A Q&A with Barbara Bennett
When they were released this past January, the final HITECH regulations amending the HIPAA Security, Privacy, Breach and Enforcement Rules updated those regulations with expansion of the scope of the rules, increased patient protections and more stringent government oversight, including application of the rules to contractors and subcontractors. So what does this mean for healthcare organizations and the service providers that work with them? I asked Barbara Bennett, partner at Hogan Lovells, LLP in Washington, DC to explain the finer points of the final rules.

A Q&A with Jacob Olcott
As Jacob Olcott, principal in cybersecurity at Good Harbor Security Risk Management, LLC points out, the SEC Guidance released in 2011 brings the issue of data security out of the IT realm and into corporate governance. But these rules for publicly traded companies are still relatively new and what they mean in terms of legal exposure is still largely untested. Olcott answered a few of my questions about the guidance and how companies can minimize their risks.